EUVD-2026-76022
GHSA-qpmw-pvq9-j6gq
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Network delivery, no prior auth, high complexity for signature bypass, user must load package, scope changed to kernel via driver; full C/I/A justified at driver-execution level.
Primary rating from Vendor (SICK AG).
CVSS VectorVendor: SICK AG
Lifecycle Timeline
2DescriptionCVE.org
An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, and triggering the execution of attacker-controlled code. User interaction is required.
AnalysisAI
Remote code execution in SICK AG's Sentio Creator Extension 'Device Manager' allows an unauthenticated network attacker, with required user interaction, to execute arbitrary code on a target system by delivering a malicious device driver package that bypasses the application's driver verification mechanism. The vulnerability (CWE-347) stems from improper verification of cryptographic signatures on driver packages, with the 'Jwt Attack' tag suggesting the verification layer uses JWT tokens susceptible to forgery or algorithm manipulation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | User interaction is required - the victim must actively load the malicious device driver package within Sentio Creator Extension Device Manager. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) scores 8.3 and reflects a network-reachable, unauthenticated attack of elevated complexity requiring user interaction and achieving full scope-changed impact (kernel/OS level via driver). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the SICK PSIRT advisory at https://www.sick.com/psirt and the CSAF document https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0012.pdf for vendor-released patch status; no specific fixed version is independently confirmed from the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Sentio Creator Extension installations, disable automatic driver installation features, and restrict driver package loading to authorized system administrators only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Share
External POC / Exploit Code
Leaving vuln.today